Examkin

Soru

Zorluk: KolayIdentity and Access Management (IAM)

A solutions architect is configuring security for a new AWS account. The account will host an application that connects to an Amazon RDS database. The solutions architect needs to provide access to the AWS Management Console for a team of database administrators who already authenticate using the corporate Active Directory. Additionally, the architect needs to store the database credentials securely. Which TWO actions should the solutions architect take? (Select TWO.)

  1. Configure identity federation using AWS IAM Identity Center to grant the database administrators access to the AWS Management Console.Cevap
  2. Store the database credentials in AWS Secrets Manager and configure automatic credential rotation.Cevap
  3. C
    Create individual IAM users with long-term credentials in the AWS account for each database administrator.
  4. D
    Use the AWS account root user credentials to perform daily database administrative tasks.
  5. E
    Store the database credentials as plaintext String parameters in Systems Manager Parameter Store.

Cevap

The database administrators should access the AWS Management Console using identity federation with AWS IAM Identity Center, and the database credentials should be stored in AWS Secrets Manager with automatic rotation enabled.
The correct actions are to configure identity federation using AWS IAM Identity Center and to store database credentials in AWS Secrets Manager with automatic rotation. Integrating AWS IAM Identity Center with the corporate Active Directory allows users to authenticate using their existing credentials and avoids the need to manage individual IAM users with long-term security keys. AWS Secrets Manager is the designated service to securely store, manage, and automatically rotate database credentials.

Adım Adım Çözüm

1
Determine the optimal identity management strategy for the database administrators.
Since the database administrators already authenticate via a corporate Active Directory, configure identity federation using AWS IAM Identity Center instead of creating individual IAM users.
This avoids creating individual IAM users with long-term credentials, conforming to AWS security best practices.
2
Select the correct mechanism for securing database credentials.
Store the credentials in AWS Secrets Manager and enable automatic rotation.
Secrets Manager is built to securely store, retrieve, and automatically rotate credentials, ensuring compliance and minimizing the risk of credential exposure.

Anahtar Kavram

AWS Identity and Access Management (IAM) best practices mandate using identity federation instead of long-term credentials for existing directory users, avoiding the use of root user accounts for daily tasks, and securing sensitive database credentials using dedicated secrets management services with automatic rotation.
Bu soruyu puanla

Konular

Identity and Access Management (IAM)

Bu konudan daha fazla soru